JumpList Automatic Files

Overview

Evidence: JumpList Automatic Files Description: Collect JumpList Automatic Files Category: System Platform: windows Short Name: jmplautocol Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): Yes

Background

AutomaticDestinations JumpLists track recent documents per application. This data is essential for reconstructing file usage and application activity.

Data Collected

This collector gathers structured data about jumplist automatic files.

Collection Method

This collector walks user JumpList directories, copies .automaticDestinations-ms files, and records file timestamps into jumplist_automatic_collected_files.

Forensic Value

This evidence is crucial for forensic investigations as JumpLists reveal recently used files even after deletion.